palaryn 0.1.0

package/dist/src/dlp/text-normalizer.js

@@ -0,0 +1,203 @@
+"use strict";
+/**
+ * Text normalizer for bypass-resistant prompt injection detection.
+ *
+ * Applies a series of transformations to collapse evasion techniques
+ * (zero-width chars, HTML entities, homoglyphs, leetspeak, etc.)
+ * into canonical ASCII text before pattern matching.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LEETSPEAK_MAP = exports.HOMOGLYPH_MAP = exports.ZERO_WIDTH_REGEX = void 0;
+exports.normalizeText = normalizeText;
+exports.normalizeLeetspeak = normalizeLeetspeak;
+// ---------------------------------------------------------------------------
+// Zero-width character stripping
+// ---------------------------------------------------------------------------
+/** Regex matching zero-width and invisible Unicode characters. */
+exports.ZERO_WIDTH_REGEX = /[\u200B\u200C\u200D\u00AD\uFEFF\u200E\u200F\u2060\u2061\u2062\u2063\u2064\u180E]/g;
+// ---------------------------------------------------------------------------
+// Homoglyph map (visually similar characters -> ASCII equivalents)
+// ---------------------------------------------------------------------------
+/** Map of Unicode homoglyphs to their ASCII equivalents. */
+exports.HOMOGLYPH_MAP = {
+    // Cyrillic -> Latin
+    '\u0430': 'a', // а
+    '\u0435': 'e', // е
+    '\u043E': 'o', // о
+    '\u0440': 'p', // р
+    '\u0441': 'c', // с
+    '\u0443': 'y', // у
+    '\u0445': 'x', // х
+    '\u0456': 'i', // і
+    '\u0458': 'j', // ј
+    '\u04BB': 'h', // һ
+    '\u0410': 'A', // А
+    '\u0412': 'B', // В
+    '\u0415': 'E', // Е
+    '\u041A': 'K', // К
+    '\u041C': 'M', // М
+    '\u041D': 'H', // Н
+    '\u041E': 'O', // О
+    '\u0420': 'P', // Р
+    '\u0421': 'C', // С
+    '\u0422': 'T', // Т
+    '\u0425': 'X', // Х
+    // Greek -> Latin
+    '\u03B1': 'a', // α
+    '\u03BF': 'o', // ο
+    '\u03C1': 'p', // ρ
+    '\u0391': 'A', // Α
+    '\u0392': 'B', // Β
+    '\u0395': 'E', // Ε
+    '\u0397': 'H', // Η
+    '\u0399': 'I', // Ι
+    '\u039A': 'K', // Κ
+    '\u039C': 'M', // Μ
+    '\u039D': 'N', // Ν
+    '\u039F': 'O', // Ο
+    '\u03A1': 'P', // Ρ
+    '\u03A4': 'T', // Τ
+    '\u03A7': 'X', // Χ
+    '\u03A5': 'Y', // Υ
+    '\u0396': 'Z', // Ζ
+    // Fullwidth -> ASCII (supplemental to NFKC — belt and suspenders)
+    '\uFF41': 'a',
+    '\uFF42': 'b',
+    '\uFF43': 'c',
+    '\uFF49': 'i',
+    '\uFF4E': 'n',
+    '\uFF4F': 'o',
+    '\uFF50': 'p',
+    '\uFF52': 'r',
+    '\uFF53': 's',
+    '\uFF54': 't',
+    '\uFF55': 'u',
+    // Common lookalikes
+    '\u0131': 'i', // ı (dotless i)
+    '\u0237': 'j', // ȷ (dotless j)
+    '\u01C0': 'l', // ǀ (dental click -> l)
+};
+// Build reverse lookup for efficiency
+const homoglyphRegex = new RegExp('[' + Object.keys(exports.HOMOGLYPH_MAP).join('') + ']', 'g');
+// ---------------------------------------------------------------------------
+// Leetspeak map
+// ---------------------------------------------------------------------------
+/** Map of common leetspeak substitutions to their letter equivalents. */
+exports.LEETSPEAK_MAP = {
+    '0': 'o',
+    '1': 'i',
+    '3': 'e',
+    '4': 'a',
+    '5': 's',
+    '7': 't',
+    '@': 'a',
+    '$': 's',
+    '!': 'i',
+};
+const leetspeakRegex = /[013457@$!]/g;
+// ---------------------------------------------------------------------------
+// HTML entity decoding
+// ---------------------------------------------------------------------------
+/** Named HTML entities most commonly used for evasion. */
+const NAMED_ENTITIES = {
+    '&lt;': '<',
+    '&gt;': '>',
+    '&amp;': '&',
+    '&quot;': '"',
+    '&apos;': "'",
+    '&nbsp;': ' ',
+    '&tab;': '\t',
+};
+/** Decode HTML entities (named + numeric decimal + numeric hex). */
+function decodeHTMLEntities(input) {
+    // Named entities
+    let result = input;
+    for (const [entity, char] of Object.entries(NAMED_ENTITIES)) {
+        // Case-insensitive replacement for named entities
+        const re = new RegExp(entity.replace(/[&;]/g, (c) => '\\' + c), 'gi');
+        result = result.replace(re, char);
+    }
+    // Decimal numeric entities: &#105; -> 'i'
+    result = result.replace(/&#(\d+);/g, (_match, digits) => {
+        const code = parseInt(digits, 10);
+        if (code > 0 && code <= 0x10FFFF) {
+            return String.fromCodePoint(code);
+        }
+        return _match;
+    });
+    // Hex numeric entities: &#x69; -> 'i'
+    result = result.replace(/&#x([0-9a-fA-F]+);/g, (_match, hex) => {
+        const code = parseInt(hex, 16);
+        if (code > 0 && code <= 0x10FFFF) {
+            return String.fromCodePoint(code);
+        }
+        return _match;
+    });
+    return result;
+}
+// ---------------------------------------------------------------------------
+// URL decoding
+// ---------------------------------------------------------------------------
+/** Decode percent-encoded sequences (%69 -> 'i'). */
+function decodeURLEncoding(input) {
+    try {
+        return decodeURIComponent(input);
+    }
+    catch {
+        // If decoding fails (malformed sequences), apply partial decoding
+        return input.replace(/%([0-9a-fA-F]{2})/g, (_match, hex) => {
+            return String.fromCharCode(parseInt(hex, 16));
+        });
+    }
+}
+// ---------------------------------------------------------------------------
+// Main normalizer
+// ---------------------------------------------------------------------------
+/**
+ * Normalize text for bypass-resistant pattern matching.
+ *
+ * Applies transformations in order:
+ * 1. Strip zero-width / invisible Unicode characters
+ * 2. Unicode NFKC normalization (collapses fullwidth, ligatures, etc.)
+ * 3. Decode HTML entities (named + numeric)
+ * 4. Decode URL percent-encoding
+ * 5. Collapse homoglyphs (Cyrillic/Greek lookalikes -> ASCII)
+ * 6. Collapse repeated whitespace to single space
+ *
+ * @param input - The raw text to normalize.
+ * @returns The normalized text suitable for pattern matching.
+ */
+function normalizeText(input) {
+    // Early exit for very short strings
+    if (input.length === 0)
+        return input;
+    let text = input;
+    // 1. Strip zero-width characters
+    text = text.replace(exports.ZERO_WIDTH_REGEX, '');
+    // 2. NFKC normalization (fullwidth -> ASCII, ligatures -> components, etc.)
+    text = text.normalize('NFKC');
+    // 3. Decode HTML entities
+    text = decodeHTMLEntities(text);
+    // 4. Decode URL percent-encoding
+    text = decodeURLEncoding(text);
+    // 5. Collapse homoglyphs
+    text = text.replace(homoglyphRegex, (ch) => exports.HOMOGLYPH_MAP[ch] || ch);
+    // 6. Collapse whitespace (spaces, tabs, newlines) to single space and trim
+    text = text.replace(/\s+/g, ' ').trim();
+    return text;
+}
+/**
+ * Apply leetspeak normalization on top of standard normalization.
+ *
+ * Returns the leet-decoded version of the text. Callers should match
+ * patterns against BOTH the standard-normalized and leet-normalized text
+ * to catch leet evasions without causing false positives on normal text
+ * containing digits.
+ *
+ * @param normalizedInput - Text already passed through normalizeText().
+ * @returns The leet-decoded text.
+ */
+function normalizeLeetspeak(normalizedInput) {
+    return normalizedInput.replace(leetspeakRegex, (ch) => exports.LEETSPEAK_MAP[ch] || ch);
+}
+//# sourceMappingURL=text-normalizer.js.map

package/dist/src/dlp/text-normalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text-normalizer.js","sourceRoot":"","sources":["../../../src/dlp/text-normalizer.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAkLH,sCAyBC;AAaD,gDAEC;AAxND,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,kEAAkE;AACrD,QAAA,gBAAgB,GAAG,mFAAmF,CAAC;AAEpH,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAE9E,4DAA4D;AAC/C,QAAA,aAAa,GAA2B;IACnD,oBAAoB;IACpB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,iBAAiB;IACjB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,QAAQ,EAAE,GAAG,EAAE,IAAI;IACnB,kEAAkE;IAClE,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,oBAAoB;IACpB,QAAQ,EAAE,GAAG,EAAE,gBAAgB;IAC/B,QAAQ,EAAE,GAAG,EAAE,gBAAgB;IAC/B,QAAQ,EAAE,GAAG,EAAE,wBAAwB;CACxC,CAAC;AAEF,sCAAsC;AACtC,MAAM,cAAc,GAAG,IAAI,MAAM,CAC/B,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAa,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,EAC/C,GAAG,CACJ,CAAC;AAEF,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,yEAAyE;AAC5D,QAAA,aAAa,GAA2B;IACnD,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;CACT,CAAC;AAEF,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,GAAG;IACZ,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,KAAa;IACvC,iBAAiB;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,kDAAkD;QAClD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACtE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,qDAAqD;AACrD,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YACzD,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,SAAgB,aAAa,CAAC,KAAa;IACzC,oCAAoC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,iCAAiC;IACjC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAgB,EAAE,EAAE,CAAC,CAAC;IAE1C,4EAA4E;IAC5E,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE9B,0BAA0B;IAC1B,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAEhC,iCAAiC;IACjC,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE/B,yBAAyB;IACzB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,qBAAa,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAErE,2EAA2E;IAC3E,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAExC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,kBAAkB,CAAC,eAAuB;IACxD,OAAO,eAAe,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,qBAAa,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAClF,CAAC"}

package/dist/src/dlp/trufflehog-backend.d.ts

@@ -0,0 +1,64 @@
+import { DLPBackend, DLPDetection } from './interfaces';
+/**
+ * Configuration for the TruffleHog DLP backend.
+ */
+export interface TruffleHogConfig {
+    /** Path to the trufflehog binary. Defaults to 'trufflehog' (resolved via PATH). */
+    binaryPath?: string;
+    /** Execution timeout in milliseconds. Defaults to 10000 (10s). */
+    timeout?: number;
+}
+/**
+ * DLP backend that delegates secret scanning to the TruffleHog binary.
+ *
+ * TruffleHog is a comprehensive secret scanner that supports 700+ detector
+ * types including verified credential checks against live services.
+ *
+ * This backend writes the input string to a temporary file, runs
+ * `trufflehog filesystem --json --no-update <tmpfile>`, and parses the
+ * line-delimited JSON output into DLPDetection objects.
+ *
+ * Graceful degradation: if the trufflehog binary is not installed or the
+ * process fails for any reason, the backend logs a warning and returns an
+ * empty array (no detections). This allows it to be safely composed with
+ * other backends without breaking the pipeline.
+ */
+export declare class TruffleHogBackend implements DLPBackend {
+    readonly name = "trufflehog";
+    private readonly binaryPath;
+    private readonly timeout;
+    constructor(config?: TruffleHogConfig);
+    /**
+     * Scan a string for secrets using trufflehog.
+     *
+     * 1. Writes the value to a temp file
+     * 2. Runs trufflehog filesystem in JSON mode
+     * 3. Parses each JSON line into a DLPDetection
+     * 4. Cleans up the temp file
+     *
+     * Returns an empty array if trufflehog is not available or fails.
+     */
+    scanString(value: string): DLPDetection[];
+    /**
+     * Parse trufflehog JSON output (one JSON object per line) into DLPDetection[].
+     *
+     * Each line is an independent JSON object representing a single finding.
+     */
+    private parseOutput;
+    /**
+     * Convert a single trufflehog finding to a DLPDetection.
+     *
+     * Severity mapping:
+     *   - Verified findings -> 'high' (credential confirmed active)
+     *   - Unverified findings -> 'medium' (potential secret)
+     */
+    private findingToDetection;
+    /**
+     * Check if the error is simply a "no findings" situation rather than a real failure.
+     *
+     * TruffleHog may exit with code 0 and empty output, or in some versions
+     * it may produce an error-like message when there are no findings.
+     */
+    private isNoFindingsError;
+}
+//# sourceMappingURL=trufflehog-backend.d.ts.map

package/dist/src/dlp/trufflehog-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trufflehog-backend.d.ts","sourceRoot":"","sources":["../../../src/dlp/trufflehog-backend.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAiBD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAkB,YAAW,UAAU;IAClD,QAAQ,CAAC,IAAI,gBAAgB;IAE7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,MAAM,CAAC,EAAE,gBAAgB;IAKrC;;;;;;;;;OASG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,EAAE;IAqCzC;;;;OAIG;IACH,OAAO,CAAC,WAAW;IA2BnB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAiC1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;CAK1B"}

package/dist/src/dlp/trufflehog-backend.js

@@ -0,0 +1,151 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TruffleHogBackend = void 0;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const crypto_1 = require("crypto");
+/**
+ * DLP backend that delegates secret scanning to the TruffleHog binary.
+ *
+ * TruffleHog is a comprehensive secret scanner that supports 700+ detector
+ * types including verified credential checks against live services.
+ *
+ * This backend writes the input string to a temporary file, runs
+ * `trufflehog filesystem --json --no-update <tmpfile>`, and parses the
+ * line-delimited JSON output into DLPDetection objects.
+ *
+ * Graceful degradation: if the trufflehog binary is not installed or the
+ * process fails for any reason, the backend logs a warning and returns an
+ * empty array (no detections). This allows it to be safely composed with
+ * other backends without breaking the pipeline.
+ */
+class TruffleHogBackend {
+    constructor(config) {
+        this.name = 'trufflehog';
+        this.binaryPath = config?.binaryPath ?? 'trufflehog';
+        this.timeout = config?.timeout ?? 10000;
+    }
+    /**
+     * Scan a string for secrets using trufflehog.
+     *
+     * 1. Writes the value to a temp file
+     * 2. Runs trufflehog filesystem in JSON mode
+     * 3. Parses each JSON line into a DLPDetection
+     * 4. Cleans up the temp file
+     *
+     * Returns an empty array if trufflehog is not available or fails.
+     */
+    scanString(value) {
+        const tmpFile = (0, path_1.join)((0, os_1.tmpdir)(), `palaryn-dlp-${(0, crypto_1.randomUUID)()}.tmp`);
+        try {
+            // Write input to temp file for trufflehog to scan
+            (0, fs_1.writeFileSync)(tmpFile, value, 'utf-8');
+            // Execute trufflehog
+            const stdout = (0, child_process_1.execFileSync)(this.binaryPath, ['filesystem', '--json', '--no-update', tmpFile], {
+                timeout: this.timeout,
+                encoding: 'utf-8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            return this.parseOutput(stdout, value);
+        }
+        catch (err) {
+            // Graceful degradation: log and return empty
+            const message = err instanceof Error ? err.message : String(err);
+            // Only log if it's not a "no findings" exit (trufflehog exits 0 with no output when clean)
+            if (!this.isNoFindingsError(message)) {
+                console.warn(`[TruffleHogBackend] scan failed: ${message}`);
+            }
+            return [];
+        }
+        finally {
+            // Always clean up the temp file
+            try {
+                (0, fs_1.unlinkSync)(tmpFile);
+            }
+            catch {
+                // Ignore cleanup errors
+            }
+        }
+    }
+    /**
+     * Parse trufflehog JSON output (one JSON object per line) into DLPDetection[].
+     *
+     * Each line is an independent JSON object representing a single finding.
+     */
+    parseOutput(stdout, originalValue) {
+        if (!stdout || !stdout.trim()) {
+            return [];
+        }
+        const detections = [];
+        const lines = stdout.trim().split('\n');
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            try {
+                const finding = JSON.parse(trimmed);
+                const detection = this.findingToDetection(finding, originalValue);
+                if (detection) {
+                    detections.push(detection);
+                }
+            }
+            catch {
+                // Skip malformed JSON lines
+                continue;
+            }
+        }
+        return detections;
+    }
+    /**
+     * Convert a single trufflehog finding to a DLPDetection.
+     *
+     * Severity mapping:
+     *   - Verified findings -> 'high' (credential confirmed active)
+     *   - Unverified findings -> 'medium' (potential secret)
+     */
+    findingToDetection(finding, originalValue) {
+        const detectorName = finding.DetectorName;
+        if (!detectorName) {
+            return null;
+        }
+        const raw = finding.Raw || finding.RawV2 || '';
+        const severity = finding.Verified ? 'high' : 'medium';
+        // Locate the raw finding within the original string
+        let start = 0;
+        let end = 0;
+        if (raw) {
+            const idx = originalValue.indexOf(raw);
+            if (idx !== -1) {
+                start = idx;
+                end = idx + raw.length;
+            }
+            else {
+                // If we can't locate the raw match, use the full string range
+                start = 0;
+                end = originalValue.length;
+            }
+        }
+        return {
+            pattern_name: `trufflehog:${detectorName}`,
+            severity,
+            match: raw || originalValue,
+            start,
+            end,
+        };
+    }
+    /**
+     * Check if the error is simply a "no findings" situation rather than a real failure.
+     *
+     * TruffleHog may exit with code 0 and empty output, or in some versions
+     * it may produce an error-like message when there are no findings.
+     */
+    isNoFindingsError(message) {
+        // execFileSync throws if the process exits with non-zero or produces no output
+        // for an empty scan. Check for common benign patterns.
+        return message.includes('ENOENT') === false && message.includes('ETIMEDOUT') === false;
+    }
+}
+exports.TruffleHogBackend = TruffleHogBackend;
+//# sourceMappingURL=trufflehog-backend.js.map

package/dist/src/dlp/trufflehog-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trufflehog-backend.js","sourceRoot":"","sources":["../../../src/dlp/trufflehog-backend.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAC7C,2BAA+C;AAC/C,2BAA4B;AAC5B,+BAA4B;AAC5B,mCAAoC;AA6BpC;;;;;;;;;;;;;;GAcG;AACH,MAAa,iBAAiB;IAM5B,YAAY,MAAyB;QAL5B,SAAI,GAAG,YAAY,CAAC;QAM3B,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,YAAY,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAM,CAAC;IAC3C,CAAC;IAED;;;;;;;;;OASG;IACH,UAAU,CAAC,KAAa;QACtB,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,eAAe,IAAA,mBAAU,GAAE,MAAM,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,kDAAkD;YAClD,IAAA,kBAAa,EAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAEvC,qBAAqB;YACrB,MAAM,MAAM,GAAG,IAAA,4BAAY,EACzB,IAAI,CAAC,UAAU,EACf,CAAC,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,EAChD;gBACE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YAEF,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,6CAA6C;YAC7C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,2FAA2F;YAC3F,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,gCAAgC;YAChC,IAAI,CAAC;gBACH,IAAA,eAAU,EAAC,OAAO,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,MAAc,EAAE,aAAqB;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAmB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAsB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAClE,IAAI,SAAS,EAAE,CAAC;oBACd,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;gBAC5B,SAAS;YACX,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,OAA0B,EAAE,aAAqB;QAC1E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAgB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEnE,oDAAoD;QACpD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,KAAK,GAAG,GAAG,CAAC;gBACZ,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,8DAA8D;gBAC9D,KAAK,GAAG,CAAC,CAAC;gBACV,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO;YACL,YAAY,EAAE,cAAc,YAAY,EAAE;YAC1C,QAAQ;YACR,KAAK,EAAE,GAAG,IAAI,aAAa;YAC3B,KAAK;YACL,GAAG;SACJ,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,OAAe;QACvC,+EAA+E;QAC/E,uDAAuD;QACvD,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC;IACzF,CAAC;CACF;AA7ID,8CA6IC"}

package/dist/src/executor/http-executor.d.ts

@@ -0,0 +1,25 @@
+import { ToolCall } from '../types/tool-call';
+import { ToolOutput } from '../types/tool-result';
+import { ExecutorConfig } from '../types/config';
+import { ToolExecutor } from './interfaces';
+/**
+ * Check whether an IP address belongs to a private/reserved range.
+ * Blocks: loopback, link-local, private (RFC 1918), metadata endpoints,
+ * broadcast, multicast, and IPv6 equivalents.
+ */
+export declare function isPrivateIP(ip: string): boolean;
+export declare class HttpExecutor implements ToolExecutor {
+    private config;
+    private cache;
+    /** Set to false to disable SSRF protection (for testing only). */
+    ssrfProtectionEnabled: boolean;
+    constructor(config: ExecutorConfig);
+    execute(toolCall: ToolCall): Promise<ToolOutput>;
+    private makeRequest;
+    private getCacheKey;
+    private getFromCache;
+    private setCache;
+    clearCache(): void;
+    private sleep;
+}
+//# sourceMappingURL=http-executor.d.ts.map

package/dist/src/executor/http-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-executor.d.ts","sourceRoot":"","sources":["../../../src/executor/http-executor.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAK5C;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CA0C/C;AAwCD,qBAAa,YAAa,YAAW,YAAY;IAC/C,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,KAAK,CAA0B;IACvC,kEAAkE;IAC3D,qBAAqB,EAAE,OAAO,CAAQ;gBAEjC,MAAM,EAAE,cAAc;IAM5B,OAAO,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IAmEtD,OAAO,CAAC,WAAW;IAwGnB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,QAAQ;IAahB,UAAU,IAAI,IAAI;IAKlB,OAAO,CAAC,KAAK;CAGd"}